The famous American databroker Experian in the UK was confronted with a court decision in a case against the Information Commissioner regarding data protection. The court has decided that data collected with consent cannot be used for further processing without additional consent, especially the disclosure of such data to a third party:

52. It is reiterated that when data is provided on the basis of consent to one controller and that data is then processed by a different controller on a different basis (legitimate interest) then the initial basis of consent is not sufficiently clear. It is averred also that the right to object to direct marketing processing Article 21(2) is now put right, which Experian’s processing circumvents to the detriment of data subjects and its commercial advantage.

Background:

1. Experian is a well-known Credit Reference Agency (“CRA”). In that capacity it holds and processes data relating to over 51 million people living in the United Kingdom, effectively the whole of the adult population. What is less well known is that Experian has within it a business unit, Experian Marketing Services (“EMS”), which processes the data of around 51 million people in the UK to provide marketing services which it sells to its third-party clients. It does so by combining their name and address information, with a total of up to thirteen actual attributes. It then processes this data and creates modelled information on the demographic, social, economic and behavioural characteristics of these 51 million individuals on a predictive basis, the profile for each person running to as many as 49 derived data points about individuals and up to 370 modelled points about individuals, with each profile running to many pages. (…)

6. Broadly, Experian has no direct relationship with individuals whose data it processes for the purpose of these products, except in a limited number of cases when individuals contact Experian via the Experian website or where they have a direct relationship with Experian via Experian Consumer Services (“ECS”).

7. ConsumerView contains entries at an individual level for some 51 million adults in the United Kingdom, that number changing from time to time due to changes in the UK adult population, as a result of deaths and people turning 18. ConsumerView combines name and address information, with a total of up to thirteen actual attributes. It then processes this data and creates modelled information on the demographic, social, economic and behavioural characteristics of individuals and households on a predictive basis. The actual information reflects known characteristics of a given individual; the derived information reflects characteristics that are calculated or ascertained from other data, the modelled information reflecting predicted characteristics.

8. ChannelView’s database contains names, postal addresses, email addresses and mobile phone numbers are predominantly provided to Experian by various third data suppliers who between them collect data from data subjects via some 148 websites in return for access to offers and discounts, price comparison services, the ability to participate in surveys and so on. The total number of records will vary from time to time, but it contains details of at least 24 million individuals.

It is amazing that this type of data brokers are allowed to operate without license and supervision and that they only have to apply data protection legislation, that in practice seldom is enforced.